linux-kernel - Re: [REGRESSION] net/ipv6/addrconf: Temporary addresses with short lifetimes generating when they shouldn't, causing applications to fail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231222153703.11268-1-dan@danm.net>
Date: Fri, 22 Dec 2023 08:37:03 -0700
From: Dan Moulding <dan@...m.net>
To: bagasdotme@...il.com
Cc: alexhenrie24@...il.com,
	dan@...m.net,
	davem@...emloft.net,
	dsahern@...nel.org,
	edumazet@...gle.com,
	kuba@...nel.org,
	linux-kernel@...r.kernel.org,
	pabeni@...hat.com,
	regressions@...ts.linux.dev
Subject: Re: [REGRESSION] net/ipv6/addrconf: Temporary addresses with short lifetimes generating when they shouldn't, causing applications to fail

> > I bisected it to commit 629df6701c8a ("net: ipv6/addrconf: clamp
> > preferred_lft to the minimum required"). Upon reviewing that change, I
> > see that it has changed when generation of temporary addresses will be
> > allowed. I believe that change might have inadvertently caused the
> > kernel to violate RFC 4941 and might need to be reverted.
>
> Can you verify that by actually reverting 629df6701c8a91 on top of net
> tree?

Yes, after bisecting it to that commit, I did revert it on top of
v6.7-rc6 and verified that the problem goes away. It doesn't start
accumulating addresses once every second. Instead the single temporary
address that was generated for the deprecated prefix is still there,
with a preferred lifetime of 0, like I'd expect, and no new addresses
get generated. The application-level problems are also gone (Chromium
loads pages without issue, and avahi-daemon hasn't jumped to 100%
CPU).

I'm now running it this way on several machines and everything is
looking good again.

-- Dan